It is very common in networks to have a server providing services to a client. The client, commonly with a user, demands a service from the server, which, usually after verification that the client has the right to access the service, provides the service to the client. Examples of such services are video-on-demand, printing of documents, and unlocking of locked doors.
Unfortunately, there are people, so called “hackers” or “pirates” who try to obtain access to such services without having the right to do so. To this end, they use various techniques to overcome the security solutions in the networks.
One of the solutions that attempt to thwart the efforts of the hackers is authentication, i.e. the server authenticates the client to ensure that it is an authentic client. The authentication may be performed using the presentation of a valid or signed identity, the presentation of a username and associated password, or protocols involving symmetric or asymmetric cryptography.
Another solution is to make sure that the receiving device is located in a particular network. For example, EP 1650671 describes a system in which a transmitter sends a random challenge to a receiver that calculates the proper response. Then, the transmitter commands the receiver to return the response and calculates the time to the reception of the response. However, the solution only allows the transmitter to calculate the distance to the receiver, while it gives no certainty whatsoever as to the nature of the receiver that may very well be emulated without the transmitter being the wiser.
Yet another solution is to use closed platforms that are difficult to reverse engineer to recover their secrets or to modify their behavior. This solution, usually used together with other solutions such as authentication, is for example used in game stations (e.g. PlayStation and Xbox), set-top boxes in pay-TV systems, triple-play modems (e.g. Freebox and Livebox) or mobile phones. This is, naturally, quite different from personal computers (PCs) for which it may be argued that their strength comes from the diversity of architectures.
While it is difficult to emulate a closed platform sufficiently to impersonate it towards the server, it has been shown that this is not impossible. The standard solution to this problem is revocation. When the system authority becomes aware that a client has been cracked, the client is put on a revocation list. During authentication, the server first verifies if the client is on the revocation list and, if so, denies service.
For the revocation to be efficient, the system authority needs to be aware that a device has been cracked. This may take a long time during which the hacker may continue to enjoy the services or, even worse, let others know how to emulate the device so that the services may be used by many people.
A solution to this problem is fingerprinting a client, for example by measuring execution time. This kind of fingerprinting assumes that an emulated client is slower than a client on a bona fide platform, but as processors still become faster and faster, this is not an assumption to be relied upon, especially for platforms of a certain age.
It can thus be appreciated that there is a need for a solution that improves upon the current security solutions, making it easier to detect emulated devices.
The present invention provides such a solution.